netbt.pdb
Static task
static1
1 signatures
General
-
Target
615476754c4467722e9ca0cf94184cf1_JaffaCakes118
-
Size
159KB
-
MD5
615476754c4467722e9ca0cf94184cf1
-
SHA1
fa223955c1acd5851eb93e8edfdeb3b26e72c219
-
SHA256
a5821933b57373ca9ab294b54018ecd869a0178cce92f298a12ad8eb4c5bd317
-
SHA512
25c2dd1be4462802698d7ee325598fe30fa15914b09245cba752ed4f6160895dbdf7a356789969572840c3278d4fcd4a917143482b4d7fe958e203d4d626f810
-
SSDEEP
3072:bnSpn2UKUlz/h9tgZY0Dv0DzxOpyveIn0C2cJaJFs0r9gkJKqDm+onBRjvt:OdKUlbzwA0C2ckJ4f+2BRjv
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 615476754c4467722e9ca0cf94184cf1_JaffaCakes118
Files
-
615476754c4467722e9ca0cf94184cf1_JaffaCakes118.sys windows:5 windows x86 arch:x86
b1e53e21d8f497ddfb48aee965d42e88
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
hal
KfReleaseSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
ntoskrnl.exe
_alldiv
SeDeassignSecurity
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
DbgPrint
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlOemStringToUnicodeString
RtlInitString
MmMapLockedPagesSpecifyCache
RtlAppendStringToString
RtlInitAnsiString
strchr
strncpy
KeCancelTimer
ZwClose
ZwCancelTimer
ZwSetTimer
ZwCreateTimer
_aulldiv
_allmul
IofCompleteRequest
IofCallDriver
IoBuildDeviceIoControlRequest
ObfReferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
KeSetTimer
KeInitializeDpc
KeInitializeTimer
IoDeleteDevice
KeClearEvent
ExDeleteResourceLite
IoFreeIrp
IoGetRelatedDeviceObject
ProbeForWrite
_except_handler3
RtlCopyUnicodeString
DbgBreakPoint
ZwCreateKey
memchr
ZwReadFile
ZwQueryInformationFile
RtlFreeUnicodeString
ZwCreateFile
IoRemoveShareAccess
SeAssignSecurity
RtlExtendedLargeIntegerDivide
IoCheckShareAccess
SeAccessCheck
ObReferenceObjectByHandle
NtWaitForSingleObject
ZwDeviceIoControlFile
ZwCreateEvent
wcslen
ExfInterlockedPushEntryList
ExRaiseAccessViolation
MmUserProbeAddress
IoFileObjectType
PsGetCurrentThread
ExQueueWorkItem
KeInsertQueueDpc
IoAllocateIrp
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
RtlExtendedMagicDivide
MmBuildMdlForNonPagedPool
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
swprintf
sprintf
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlMapGenericMask
IoGetFileObjectGenericMapping
SeSetSecurityDescriptorInfo
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
IoCreateDevice
RtlAppendUnicodeToString
ZwOpenKey
ZwQueryValueKey
memmove
IoBuildPartialMdl
MmUnmapLockedPages
KeDelayExecutionThread
MmLockPagableDataSection
KeTickCount
KeBugCheckEx
IoCancelIrp
IoAllocateMdl
ExfInterlockedInsertHeadList
PsGetCurrentProcess
KeAttachProcess
KeDetachProcess
ExfInterlockedInsertTailList
ObfDereferenceObject
IoFreeMdl
KeWaitForSingleObject
KeResetEvent
KeSetEvent
KeInitializeSpinLock
ExSystemTimeToLocalTime
KeInitializeEvent
ExInitializeResourceLite
strrchr
RtlCompareMemory
KeQuerySystemTime
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
strncmp
ExAllocatePoolWithTag
IoSetShareAccess
ExFreePoolWithTag
tdi.sys
TdiRegisterNetAddress
TdiProviderReady
TdiInitialize
TdiRegisterProvider
TdiRegisterPnPHandlers
TdiMapUserRequest
TdiDeregisterPnPHandlers
TdiDeregisterProvider
TdiRegisterDeviceObject
TdiDefaultDisconnectHandler
TdiDefaultErrorHandler
TdiDefaultReceiveHandler
TdiDefaultRcvExpeditedHandler
TdiDefaultSendPossibleHandler
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
TdiDefaultRcvDatagramHandler
TdiBuildNetbiosAddress
TdiDeregisterDeviceObject
TdiDeregisterNetAddress
TdiPnPPowerComplete
TdiEnumerateAddresses
TdiDefaultConnectHandler
TdiPnPPowerRequest
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 896B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGENBT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ